asherah 0.1.0-x86_64-darwin → 0.2.0-x86_64-darwin

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 798573fb66cb2a59ea43f23466216098451518160417b6b17f7f5f849ba511ac
-  data.tar.gz: edbe981c70528b10eb2fa2cd4f194c1749cbbb0c7bc5ce890c11ac91b80a295b
+  metadata.gz: f78dcaa66db09c33f15a1e2a0d79e6003387e7249abcd94dd75f4b39d3d1495f
+  data.tar.gz: ec27e86d304692f3f244d566d02d72fab3221bc343414c308a53659245b2caed
 SHA512:
-  metadata.gz: 1e66edd73d5b62c9007ee3bb0f3b418590017e266a512fb252391d42e090e0125ebc8fcf37e5dae1d49b714d5b6a9e2322c8a64127d97a14b04c4e89b73083ad
-  data.tar.gz: 8769ae256be423b11aaa742e61873feb330efb5ac15488c4d01d098263d91a30b20564437ea38d59ab338594d592d115793c1fe4796b48d2630db70a284919aa
+  metadata.gz: b6e74b580a3a09a6b6ecd730069f0fcfba950d0209b2aab30a4ebc34b51aad3fcd1cebf236e39221d4cb8d08aa14c03009fa1e38ae2a8dce8920d985af878b95
+  data.tar.gz: 11f6e7b2c2f5b686c617255aac4d1e4a7c98be675dcc95a0da0baf9298e438303e54a99a716c884c374950f6dedcb0f0957757cf105414bbdc6663e67317c847

data/.rubocop.yml

@@ -4,6 +4,7 @@ AllCops:
   SuggestExtensions: false
   Exclude:
     - 'vendor/**/*' # Github Actions
+    - 'tmp/**/*'
 
 Layout/LineLength:
   Max: 120

data/CHANGELOG.md

@@ -1,5 +1,13 @@
 ## [Unreleased]
 
+## [0.2.0] - 2022-03-21
+
+- Implement versioning for asherah-cobhan binaries
+- Upgrade to use asherah-cobhan v0.3.1
+- Add BadConfig error and expose error codes
+- Remove DRR methods and use JSON exclusively
+- Cross language testing using Asherah Go
+
 ## [0.1.0] - 2022-03-14
 
 - First official release

data/Gemfile

@@ -6,3 +6,5 @@ source 'https://rubygems.org'
 gemspec
 
 gem 'rake', '~> 13.0'
+
+gem 'cucumber', '~> 7.1.0'

data/README.md

@@ -34,10 +34,10 @@ Configure Asherah:
 
 ```ruby
 Asherah.configure do |config|
-  config.kms_type = 'static'
+  config.kms = 'static'
   config.metastore = 'memory'
-  config.service_name = 'gem'
-  config.product_id = 'sable'
+  config.service_name = 'service'
+  config.product_id = 'product'
 end
 ```
 
@@ -46,15 +46,15 @@ Encrypt some data for a `partition_id`
 ```ruby
 partition_id = 'user_1'
 data = 'Some PII data'
-data_row_record = Asherah.encrypt(partition_id, data)
-p data_row_record
+data_row_record_json = Asherah.encrypt(partition_id, data)
+puts data_row_record_json
 ```
 
-Decrypt `data_row_record`
+Decrypt `data_row_record_json`
 
 ```ruby
-decrypted_data = Asherah.decrypt(partition_id, data_row_record)
-p decrypted_data
+decrypted_data = Asherah.decrypt(partition_id, data_row_record_json)
+puts decrypted_data
 ```
 
 ## Development

data/Rakefile

@@ -3,7 +3,6 @@
 require 'bundler/gem_tasks'
 require 'rspec/core/rake_task'
 require 'rubygems/package'
-require 'open-uri'
 
 RSpec::Core::RakeTask.new(:spec)
 
@@ -13,6 +12,7 @@ RuboCop::RakeTask.new
 
 task default: %i[spec rubocop]
 
+ASHERAH_BIN = 'bin/download-asherah.sh'
 DISTRIBUTIONS = {
   'x86_64-linux' => ['libasherah-x64.so'],
   'x86_64-darwin' => ['libasherah-x64.dylib'],
@@ -20,6 +20,19 @@ DISTRIBUTIONS = {
   'arm64-darwin' => ['libasherah-arm64.dylib']
 }.freeze
 
+def current_filename
+  @current_filename ||=
+    begin
+      require 'cobhan'
+      Class.new.extend(Cobhan).library_file_name('libasherah')
+    end
+end
+
+def current_platform
+  @distribution ||= DISTRIBUTIONS.detect { |_k, v| v.include?(current_filename) }
+  @distribution.first
+end
+
 def native_build(platform, native_files)
   puts "Building gem for #{platform}"
 
@@ -32,14 +45,14 @@ def native_build(platform, native_files)
 
   # Copy files to tmp gem dir
   gemspec = Bundler.load_gemspec('asherah.gemspec')
-  gemspec.files.each do |file|
+  (gemspec.files + [ASHERAH_BIN]).each do |file|
     dir = File.dirname(file)
     filename = File.basename(file)
     FileUtils.mkdir_p(File.join(tmp_gem_dir, dir))
     FileUtils.copy_file(file, File.join(tmp_gem_dir, dir, filename))
   end
 
-  # Set platform for native gem build and remove extentions
+  # Set platform for native gem build
   gemspec.platform = Gem::Platform.new(platform)
 
   native_dir = 'lib/asherah/native'
@@ -47,16 +60,16 @@ def native_build(platform, native_files)
     FileUtils.mkdir_p(native_dir)
     native_files.each do |native_file|
       native_file_path = File.join(native_dir, native_file)
-      gemspec.files << native_file_path
 
-      File.open(native_file_path, 'wb') do |file|
-        url = "https://github.com/godaddy/asherah-cobhan/releases/download/current/#{native_file}"
-        puts "Downloading #{url}"
-        file << URI.parse(url).open.read
-      end
+      # Download native file
+      download_asherah_path = File.join(tmp_gem_dir, ASHERAH_BIN)
+      system("#{download_asherah_path} #{native_file}")
+
+      # Add native file in gemspec
+      gemspec.files << native_file_path
     end
 
-    package = Gem::Package.build gemspec
+    package = Gem::Package.build(gemspec)
     FileUtils.mv package, File.join(pkg_dir, package)
   end
 end
@@ -78,17 +91,25 @@ namespace :native do
     end
   end
 
-  namespace :smoke do
-    require 'cobhan'
+  namespace :current do
+    desc 'Download asherah binary for current platform'
+    task :download do
+      download_asherah_path = File.join(__dir__, ASHERAH_BIN)
+      system("#{download_asherah_path} #{current_filename}")
+    end
 
-    filename = Class.new.extend(Cobhan).library_file_name('libasherah')
-    platform, _files = DISTRIBUTIONS.detect { |_k, v| v.include?(filename) }
+    desc 'Build native gem for current platform'
+    task :build do
+      native_build(current_platform, DISTRIBUTIONS[current_platform])
+    end
 
-    desc "Smoke test native gem on #{platform} platform"
-    task "#{platform}": :"build:#{platform}" do
+    desc 'Smoke test native gem for current platform'
+    task smoke: :build do
+      platform = current_platform
       gemspec = Bundler.load_gemspec('asherah.gemspec')
       gemspec.platform = Gem::Platform.new(platform)
 
+      sh('gem uninstall asherah')
       sh("gem install pkg/#{gemspec.file_name}")
       sh('ruby spec/smoke_test.rb')
     end

data/asherah.gemspec

@@ -34,7 +34,7 @@ Gem::Specification.new do |spec|
   spec.executables = spec.files.grep(%r{\Aexe/}) { |f| File.basename(f) }
   spec.require_paths = ['lib']
 
-  spec.add_dependency 'cobhan', '~> 0.1.3'
+  spec.add_dependency 'cobhan', '~> 0.2.0'
   spec.add_development_dependency 'dotenv', '~> 2.7.6'
   spec.add_development_dependency 'rspec', '~> 3.10.0'
   spec.add_development_dependency 'rubocop', '~> 1.7'

data/lib/asherah/error.rb

@@ -9,20 +9,22 @@ module Asherah
     GetSessionFailed = Class.new(StandardError)
     EncryptFailed = Class.new(StandardError)
     DecryptFailed = Class.new(StandardError)
+    BadConfig = Class.new(StandardError)
 
     CODES = {
       -100 => NotInitialized,
       -101 => AlreadyInitialized,
       -102 => GetSessionFailed,
       -103 => EncryptFailed,
-      -104 => DecryptFailed
+      -104 => DecryptFailed,
+      -105 => BadConfig
     }.freeze
 
     def self.check_result!(result, message)
       return unless result.negative?
 
       error_class = Error::CODES.fetch(result, StandardError)
-      raise error_class, message
+      raise error_class, "#{message} (#{result})"
     end
   end
 end

data/lib/asherah/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Asherah
-  VERSION = '0.1.0'
+  VERSION = '0.2.0'
 end

data/lib/asherah.rb

@@ -3,9 +3,6 @@
 require_relative 'asherah/version'
 require 'asherah/config'
 require 'asherah/error'
-require 'asherah/key_meta'
-require 'asherah/data_row_record'
-require 'asherah/envelope_key_record'
 require 'cobhan'
 
 # Asherah is a Ruby wrapper around Asherah Go application-layer encryption SDK.
@@ -15,10 +12,9 @@ module Asherah
   LIB_ROOT_PATH = File.expand_path('asherah/native', __dir__)
   load_library(LIB_ROOT_PATH, 'libasherah', [
     [:SetupJson, [:pointer], :int32],
-    [:Encrypt, [:pointer, :pointer, :pointer, :pointer, :pointer, :pointer, :pointer], :int32],
-    [:Decrypt, [:pointer, :pointer, :pointer, :int64, :pointer, :int64, :pointer], :int32],
     [:EncryptToJson, [:pointer, :pointer, :pointer], :int32],
     [:DecryptFromJson, [:pointer, :pointer, :pointer], :int32],
+    [:EstimateBuffer, [:int32, :int32], :int32],
     [:Shutdown, [], :void]
   ].freeze)
 
@@ -38,89 +34,26 @@ module Asherah
       Error.check_result!(result, 'SetupJson failed')
     end
 
-    # Encrypts data for a given partition_id and returns DataRowRecord
+    # Encrypts data for a given partition_id and returns DataRowRecord in JSON format.
     #
-    # @param partition_id [String]
-    # @param data [String]
-    # @return [DataRowRecord]
-    def encrypt(partition_id, data)
-      partition_id_buffer = string_to_cbuffer(partition_id)
-      data_buffer = string_to_cbuffer(data)
-      output_encrypted_data_buffer = allocate_cbuffer(data.length + 256)
-      output_encrypted_key_buffer = allocate_cbuffer(256)
-      output_created_buffer = int_to_buffer(0)
-      output_parent_key_id_buffer = allocate_cbuffer(256)
-      output_parent_key_created_buffer = int_to_buffer(0)
-
-      result = Encrypt(
-        partition_id_buffer,
-        data_buffer,
-        output_encrypted_data_buffer,
-        output_encrypted_key_buffer,
-        output_created_buffer,
-        output_parent_key_id_buffer,
-        output_parent_key_created_buffer
-      )
-      Error.check_result!(result, 'Encrypt failed')
-
-      parent_key_meta = KeyMeta.new(
-        id: cbuffer_to_string(output_parent_key_id_buffer),
-        created: buffer_to_int(output_parent_key_created_buffer)
-      )
-      envelope_key_record = EnvelopeKeyRecord.new(
-        encrypted_key: cbuffer_to_string(output_encrypted_key_buffer),
-        created: buffer_to_int(output_created_buffer),
-        parent_key_meta: parent_key_meta
-      )
-
-      DataRowRecord.new(
-        data: cbuffer_to_string(output_encrypted_data_buffer),
-        key: envelope_key_record
-      )
-    end
-
-    # Decrypts a data_row_record for a partition_id and returns decrypted data
+    # DataRowRecord contains the encrypted key and data, as well as the information
+    # required to decrypt the key encryption key. This object data should be stored
+    # in your data persistence as it's required to decrypt data.
     #
-    # @param partition_id [String]
-    # @param data_row_record [DataRowRecord]
-    # @return [String], Decrypted data
-    def decrypt(partition_id, data_row_record)
-      partition_id_buffer = string_to_cbuffer(partition_id)
-      encrypted_data_buffer = string_to_cbuffer(data_row_record.data)
-      encrypted_key_buffer = string_to_cbuffer(data_row_record.key.encrypted_key)
-      created = data_row_record.key.created
-      parent_key_id_buffer = string_to_cbuffer(data_row_record.key.parent_key_meta.id)
-      parent_key_created = data_row_record.key.parent_key_meta.created
-
-      output_data_buffer = allocate_cbuffer(encrypted_data_buffer.size + 256)
-
-      result = Decrypt(
-        partition_id_buffer,
-        encrypted_data_buffer,
-        encrypted_key_buffer,
-        created,
-        parent_key_id_buffer,
-        parent_key_created,
-        output_data_buffer
-      )
-      Error.check_result!(result, 'Decrypt failed')
-
-      cbuffer_to_string(output_data_buffer)
-    end
-
-    def shutdown
-      Shutdown()
-    end
-
-    # Encrypts data for a given partition_id and returns DataRowRecord in JSON format
+    # EnvelopeKeyRecord represents an encrypted key and is the data structure used
+    # to persist the key in the key table. It also contains the meta data
+    # of the key used to encrypt it.
+    #
+    # KeyMeta contains the `id` and `created` timestamp for an encryption key.
     #
     # @param partition_id [String]
     # @param data [String]
     # @return [String], DataRowRecord in JSON format
-    def encrypt_to_json(partition_id, data)
+    def encrypt(partition_id, data)
       partition_id_buffer = string_to_cbuffer(partition_id)
       data_buffer = string_to_cbuffer(data)
-      output_buffer = allocate_cbuffer(data.length + 256)
+      estimated_length = EstimateBuffer(data.bytesize, partition_id.bytesize)
+      output_buffer = allocate_cbuffer(estimated_length)
 
       result = EncryptToJson(partition_id_buffer, data_buffer, output_buffer)
       Error.check_result!(result, 'EncryptToJson failed')
@@ -128,20 +61,25 @@ module Asherah
       cbuffer_to_string(output_buffer)
     end
 
-    # Decrypts a DataRowRecord in JSON format for a partition_id and returns decrypted data
+    # Decrypts a DataRowRecord in JSON format for a partition_id and returns decrypted data.
     #
     # @param partition_id [String]
     # @param json [String], DataRowRecord in JSON format
     # @return [String], Decrypted data
-    def decrypt_from_json(partition_id, json)
+    def decrypt(partition_id, json)
       partition_id_buffer = string_to_cbuffer(partition_id)
       data_buffer = string_to_cbuffer(json)
-      output_buffer = allocate_cbuffer(json.length + 256)
+      output_buffer = allocate_cbuffer(json.bytesize)
 
       result = DecryptFromJson(partition_id_buffer, data_buffer, output_buffer)
       Error.check_result!(result, 'DecryptFromJson failed')
 
       cbuffer_to_string(output_buffer)
     end
+
+    # Stop the Asherah instance
+    def shutdown
+      Shutdown()
+    end
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: asherah
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: x86_64-darwin
 authors:
 - GoDaddy
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2022-03-14 00:00:00.000000000 Z
+date: 2022-03-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: cobhan
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.1.3
+        version: 0.2.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.1.3
+        version: 0.2.0
 - !ruby/object:Gem::Dependency
   name: dotenv
   requirement: !ruby/object:Gem::Requirement
@@ -117,10 +117,7 @@ files:
 - asherah.gemspec
 - lib/asherah.rb
 - lib/asherah/config.rb
-- lib/asherah/data_row_record.rb
-- lib/asherah/envelope_key_record.rb
 - lib/asherah/error.rb
-- lib/asherah/key_meta.rb
 - lib/asherah/native/libasherah-x64.dylib
 - lib/asherah/version.rb
 homepage: https://github.com/godaddy/asherah-ruby

data/lib/asherah/data_row_record.rb

@@ -1,20 +0,0 @@
-# frozen_string_literal: true
-
-module Asherah
-  # DataRowRecord contains the encrypted key and data, as well as the information
-  # required to decrypt the key encryption key. This object data should be stored
-  # in your data persistence as it's required to decrypt data.
-  class DataRowRecord
-    attr_reader :data, :key
-
-    # Initializes a new DataRowRecord
-    #
-    # @param data [String]
-    # @param key [EnvelopeKeyRecord]
-    # @return DataRowRecord
-    def initialize(data:, key:)
-      @data = data
-      @key = key
-    end
-  end
-end

data/lib/asherah/envelope_key_record.rb

@@ -1,22 +0,0 @@
-# frozen_string_literal: true
-
-module Asherah
-  # EnvelopeKeyRecord represents an encrypted key and is the data structure used
-  # to persist the key in the key table. It also contains the meta data
-  # of the key used to encrypt it.
-  class EnvelopeKeyRecord
-    attr_reader :encrypted_key, :created, :parent_key_meta
-
-    # Initializes a new EnvelopeKeyRecord
-    #
-    # @param encrypted_key [String]
-    # @param created [Integer]
-    # @param parent_key_meta [KeyMeta]
-    # @return EnvelopeKeyRecord
-    def initialize(encrypted_key:, created:, parent_key_meta:)
-      @encrypted_key = encrypted_key
-      @created = created
-      @parent_key_meta = parent_key_meta
-    end
-  end
-end

data/lib/asherah/key_meta.rb

@@ -1,18 +0,0 @@
-# frozen_string_literal: true
-
-module Asherah
-  # KeyMeta contains the `id` and `created` timestamp for an encryption key.
-  class KeyMeta
-    attr_reader :id, :created
-
-    # Initializes a new KeyMeta
-    #
-    # @param id [String]
-    # @param created [Integer]
-    # @return KeyMeta
-    def initialize(id:, created:)
-      @id = id
-      @created = created
-    end
-  end
-end